3 ms·
(There's a not-very-convincing argument that they declared the ability to view support tickets as out of scope, but were not given a chance to assess the Slack
by cjbprime 2y ago
(There's a not-very-convincing argument that they declared the ability to view support tickets as out of scope, but were not given a chance to assess the Slack takeover exploit's scope.)
- nodamage 2y agoThe Slack takeover exploit is a problem on Slack's end (and sounds more like a configuration issue than a bug) so Zendesk would not be responsible for that anyway though.
- a_dabbler 2y agoI disagree, the problem is clearly on Zendesks end.
- nodamage 2y agoDon't get me wrong, Zendesk definitely has their own separate problem: you should not be able to CC yourself onto an existing support ticket by emailing a guessable ticket ID. But simultaneously you should not be able to get into a company Slack by simply having an account with a @company.com email address created by a third-party SSO provider. In other words, even in Zendesk fixed their problem, Slack would still have a problem on their end.